1. Who we are
The controller of personal data is [Company name], UIC [number], registered office and address: [address], hereinafter "Tripco", "we". For any questions about personal data, write to us at info@tripco.bg or at the address above.
We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the Bulgarian Personal Data Protection Act ("PDPA").
2. What data we collect, why and on what legal basis
| When | What data | Why | Legal basis | How long we keep it |
|---|---|---|---|---|
| Request for early access to the planner | First name, last name, email | To send you an invitation and instructions for the test, and to ask for your feedback | Your consent, Art. 6(1)(a) GDPR | Until the end of the test period or until consent is withdrawn, at most 24 months |
| Newsletter subscription | To send you news about Tripco, at most once a month | Consent, Art. 6(1)(a) GDPR | Until you unsubscribe; every email has an unsubscribe link | |
| Contact and enquiry form | Name, organisation, email, phone (if you give it), subject, message | To reply and prepare a demo or an offer | Steps prior to entering into a contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f) GDPR | 3 years from the last correspondence |
| Booking a demo (Calendly) | Name, email, chosen day and time, notes | To organise the online meeting | Art. 6(1)(b) GDPR | Up to 12 months after the meeting |
| "Suggest or add" | Description, place on the map, photo (optional), email (optional) | To keep the register of stops and timetables accurate | Legitimate interest, Art. 6(1)(f); for the email: consent | The suggestion is kept while it is part of the register; the email: up to 12 months |
| Searching in the planner | Start and end point, date and time; approximate location only if you allow it in your browser | To show you routes | Performance of the service, Art. 6(1)(b) GDPR | Searches are kept only in anonymised form, for statistics |
| Visiting the website | IP address, browser and device type, pages, cookies | Security and operation of the website; statistics only with consent | Legitimate interest (security); consent (statistics) | See the Cookie policy |
We do not make decisions based solely on automated processing that have legal effects for you, and we do not carry out profiling.
3. Who we share data with
We do not sell personal data. We share it only with trusted providers who process it on our behalf under a written contract (Art. 28 GDPR):
- Website hosting: Cloudflare, Inc. (USA);
- Emails and newsletter: Brevo (Sendinblue SAS, France);
- Meeting bookings: Calendly (USA);
- Visitor statistics: Google Analytics (Google Ireland Ltd.), only if you accept analytics cookies;
- Embedded video: YouTube (Google), only when you play the video;
- Platform servers: [provider, for example DigitalOcean (EU data centre)].
We may disclose data to public authorities when the law requires it.
4. Transfers outside the European Union
Some providers are in the USA. Transfers are based on the European Commission's decision on the EU-US Data Privacy Framework or on standard contractual clauses approved by the Commission (Art. 45 and Art. 46 GDPR).
5. Your rights
- to access your data and get a copy of it (Art. 15 GDPR);
- to request correction (Art. 16) or erasure (Art. 17);
- to restrict processing (Art. 18);
- to receive your data in a convenient format (portability, Art. 20);
- to object to processing based on legitimate interest (Art. 21);
- to withdraw your consent at any time, without affecting processing already carried out (Art. 7(3)).
Write to us at info@tripco.bg. We reply within one month (Art. 12(3) GDPR).
You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592.
6. Security
We use an encrypted connection (HTTPS), access limited to staff who need it, passwords and backups. If a security breach does happen, we will notify the Commission and the people affected, as required by Art. 33 and Art. 34 GDPR.
7. Children
The early access and newsletter services are for people over 14. Younger children need consent from a parent (Art. 25c PDPA).
8. Changes
If we change this policy, we will publish the new version here with the new date. For significant changes we will notify you by email.